Cybersecurity briefing — 2026-05-01

Nginx UI is being actively exploited right now through a critical authentication bypass, and patches are already shipping.

• Exchange N-day Abuse Expands Espionage Reach Across Governments
• Headless Gemini CLI Turns CI Into Host Compromise Path
• French Citizen Data Sale Creates Long-Term Fraud Pool
• SAP Build Packages Turn Install Time Into Theft Time
• CVE-2026-31431 'Copy Fail' Linux Local Privilege Escalation
• Deep#Door Turns Windows Hosts Into Stealthy Spyware Nodes
• No-Code Phishing Pages Reclaim Exchange Credentials
• Cargo Theft Moves Into Broker Email and Load Boards
• Federal OT Zero-Trust Guidance Raises Governance Bar
• SaaS Extortion Groups Hide Inside IdP Access
• Black Shrantac Turns Perimeter Flaws Into Quiet Extortion
• Soft PLC Backdoors Survive Restarts in CODESYS Runtime
• Patch Wave Will Expose Weak Supply Chains
• Handala Moves From Doxxing to Direct Troop Threats
• Russian Aviation Targets Lose GIS Data to Spyware
• Sleeper Packages Turn CI Hosts Into Credential Farms
• Immediate Remote Code Execution Risk in Ninja Forms File Uploads
• AI Workflow Builder Flaw Enables Full Server Takeover
• Former Incident Responders Joined BlackCat Extortion Crew